Sanctions Screening: The Complete Guide for Compliance Teams

Where sanctions screening fits

Screening is one control inside a wider anti-money laundering programme. It sits next to customer due diligence, transaction monitoring and reporting, but it has a different legal character, which matters more than most guides admit (see the next section). This guide covers which lists to use, who is on the hook, how matching works, how to cut false positives and what to look for in a tool.

Why sanctions are not the same as AML risk

Most AML obligations are risk-based: you decide how much diligence a customer needs. Sanctions compliance is closer to absolute. In several major regimes, OFAC can impose civil penalties on a strict-liability basis (OFAC FAQ 65), and since June 2022 the UK can do the same for financial sanctions breaches (OFSI), so liability can arise even where a firm did not know it was dealing with a designated person. The practical effect is that a risk appetite of "we accept some residual risk" does not translate neatly into sanctions. Your decisions are about how you screen well, not whether to.

Two consequences follow:

• Sanctions obligations often reach beyond regulated sectors. Many sanctions laws apply to any person within the jurisdiction, not only to banks or other reporting entities. A software company, marketplace or property business can be bound even if it has no formal AML licence.
• Ownership matters as much as the name. OFAC treats entities owned 50% or more, in aggregate, by blocked persons as blocked themselves, even when the entity is not on a list (OFAC's 50 Percent Rule). The UK applies ownership and control tests. A company can be clean on a name search and still be off-limits.

The main sanctions lists

There is no single global list. Each issuer designates under its own legal authority, and the lists overlap but are not identical. Always confirm scope and current content with the issuer, because designations and programmes change.

"Ad hoc" is deliberate. None of these issuers works on a predictable weekly cycle, and a major designation can appear at any time. That is why a once-a-month batch check is a weak design.

Many firms add other lists depending on exposure: national lists for countries where they operate, export-control and debarment lists, and regulator-specific lists. Choose based on where you operate, where your customers and counterparties sit, and which currencies and banks you use.

Who must screen

Treat these as general categories and check your own position with counsel:

• Banks, payment firms, crypto businesses, insurers and other financial institutions are expected to screen as a core control, and regulators examine it.
• Designated non-financial businesses such as real estate agents, lawyers and accountants face growing AML duties in many countries. In Australia, the "tranche 2" reforms extended AML/CTF obligations to these sectors from 1 July 2026; see our tranche 2 overview, the compliance checklist and the guide for real estate agents.
• Everyone else. Sanctions prohibitions generally apply to all persons within a jurisdiction. Marketplaces, gaming operators, telcos and exporters often screen without any AML licence because the legal risk is the same.

If you operate across borders, you may need to meet several regimes at once. A US dollar payment can bring OFAC into scope even for a non-US firm, and a UK-regulated business must follow UK measures whatever its customer's nationality.

When to screen

At onboarding

Screen before you provide a service or accept funds. Include the customer, directors, beneficial owners and controllers, and authorised signatories. For individuals, that is the person; for companies, it is everyone in the ownership chain you have identified through KYC and due diligence. Screening a company name alone leaves the biggest gap.

On an ongoing basis

Customers do not change, but lists do. Two triggers should drive re-screening:

1. List changes. When a list is updated, check the new or amended entries against your existing customer base, not just new applicants. This delta approach is more efficient than rescreening everyone against the full list daily, and it catches changes quickly.
2. Customer changes. New directors, a change of name, address or country, new ownership, or a new product should prompt a re-check.

Add periodic full re-screens as a safety net. The right cadence depends on your risk and your regulator's expectations, so document the reasoning.

On payments and counterparties

Payer, payee, intermediary banks, vessels, and payment references can all contain sanctioned names or locations. Screen counterparties such as suppliers, agents and merchants too, not just customers.

How matching actually works

Lists are not clean databases. The same person may appear under several spellings, and your own data may be incomplete. Good matching handles that without drowning analysts.

• Fuzzy matching. Finds near-matches despite typos, missing letters, word order or initials. A threshold sets how close is close enough: too strict and you miss true matches, too loose and you generate noise.
• Transliteration. Names written in Arabic, Cyrillic or Chinese scripts can be romanised in many ways ("Mohammed", "Muhammad", "Mohamed"). Matching should account for script conversion and common variants.
• Aliases and former names. List entries often carry known aliases, "a.k.a." names, and name variants. Screening against the primary name only will miss them.
• Secondary identifiers. Date of birth, nationality, country of residence, place of birth, passport or national ID numbers, and for entities, registration numbers and addresses. These do not find matches, but they confirm or rule them out.

The quality of the identifiers you collect sets the ceiling for matching quality. A name-only record against a common name will always be ambiguous. This is where identity verification helps: a verified date of birth and nationality taken from an authenticated document are far better inputs than self-declared text.

Handling false positives

Most alerts are false positives, because common names collide with list entries. The goal is not to eliminate alerts but to resolve them consistently and quickly. Practices that help:

1. Collect better data. Capture full legal name, date of birth and country at onboarding.
2. Tune thresholds by segment. A retail customer with full identifiers can tolerate a different setting than an entity with sparse data. Test changes on historical cases and record why you set them.
3. Use secondary identifiers to auto-discount obvious non-matches, such as a clearly different date of birth, and document the rule.
4. Record decisions at the entity level. If you cleared the same customer against the same list entry last week, do not make an analyst repeat it. Re-open only if the customer data or the list entry changes.
5. Define escalation. Decide who can clear, who must escalate, and when to involve the MLRO or compliance officer.

Do not "fix" volume by loosening thresholds without evidence. A regulator looking at a missed match will ask why the setting was changed.

A match review example

The following is a hypothetical illustration of how a team might work an alert from ScreenlyyID AML screening, not a real customer case.

A new customer, "Ahmed Al-Rashid", applies, and the screening check returns a potential match against a sanctions list entry with a similar name and an alias spelled "Ahmad Alrashid".

1. Compare the identifiers. The list entry gives a date of birth in 1968 and nationality of a different country. The verified passport shows a 1991 date of birth and a different nationality.
2. Check the aliases and secondary details. Place of birth and ID numbers do not match anything on the entry.
3. Decide. The analyst concludes this is a false positive, records the list, entry, identifiers compared and reasoning, and clears the alert.
4. Alternative outcome. If the date of birth and nationality had matched, the analyst would not clear it. They would escalate to the compliance officer, hold the account, and follow the required blocking or reporting steps.

Whichever way it goes, the record is what protects you later.

Sanctions vs PEP and adverse media screening

These checks are often run together but have different purposes and consequences.

• Sanctions screening is a legal prohibition check. A confirmed match usually means you cannot deal with the person, and you may have to freeze assets and report.
• PEP screening identifies politically exposed persons, and often their family members and close associates. A PEP is not prohibited. It triggers enhanced due diligence, such as source of wealth checks and senior management approval, under a risk-based approach.
• Adverse media screening looks for negative news on financial crime, corruption or similar. It is an input to risk assessment and has no list-based legal effect on its own, so quality and relevance of sources matter.

Keep the outcomes separate in your workflow. A PEP hit routes to enhanced due diligence; a sanctions hit routes to a stop-and-escalate path.

Audit trail: what to keep

Regulators and auditors judge a screening programme by what you can show. Keep, for every screen:

• The date and time, the data screened and the lists and list versions used.
• The alerts generated and the match settings in force.
• The decision, the reviewer, the reasoning and any escalation.
• Any blocking, rejection or report, with timestamps.
• Changes to configuration, with who approved them and why.

Retention periods vary by jurisdiction, so check the rules that apply to you.

Choosing a sanctions screening tool

Compare tools on what affects daily operations rather than feature lists:

• List coverage and freshness. Which lists, how quickly changes are reflected, and whether you can choose lists by customer or region.
• Matching controls. Fuzzy logic, alias and transliteration handling, secondary identifiers, and configurable thresholds.
• Ongoing monitoring. Automatic re-checks when lists change, not just screening at onboarding.
• Combined checks. Sanctions, PEP and adverse media in one call, alongside identity verification, so data flows between steps.
• Integration. A well-documented API that fits your onboarding flow, and a way to test before committing.
• Evidence. Exportable records of every screen and decision.
• Cost model. Predictable pricing as your volume grows.

ScreenlyyID offers AML, sanctions and PEP screening through an API alongside remote identity verification, with self-serve sign-up. See pricing or book a demo to test it on your own data.

A note on the rules

Sanctions programmes, list contents and regulatory expectations change often. For binding requirements, consult the issuer's own materials (OFAC, the UN Security Council, the EU Sanctions Map, UK OFSI, DFAT) and your regulator or legal counsel. This guide is information, not legal advice.